REVIEW 1 major objections 6 minor 32 references
Discovering Coordinated Processes From Social Online Networks
T0 review · 1 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read Applying process mining to retweet timing data, the paper shows that the structure and dynamics of discovered Petri net models can separate coordinated AI and human behavior from organic activity on Twitter.
desk verdict Genuinely new application of process discovery to retweet logs, but the headline claim outruns the evidence because every metric rests on an untested trace-truncation choice and descriptive comparisons. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is a free-choice stochastic Petri net, a Petri net extended with output-arc probabilities and random transition delays. It carries the argument because it represents both the structure of information flow (parallel, choice, and loop patterns) and the stochastic dynamics of that flow, going beyond static graphs and Markov chains. Discovery is performed with the Inductive Miner algorithm with a noise threshold of 0.2, and then probabilities and time distributions are fitted from the original event log; behavioral analysis uses graph density, graph diameter, mean user waiting times, and Kolmogorov-Sinai entropy computed from a Markov chain induced on the reachability graph.
What would settle it
A direct test would be to rerun the same discovery pipeline on the same datasets with full-length traces (or with cutoff lengths of 20, 50, and 100 events) and check whether the density and entropy ordering between coordinated and uncoordinated groups persists; if the ordering flips or the gap vanishes, the reported signatures are artifacts of the first-10-events truncation.
Extended reading notes
Core claim
The central claim is that event logs of retweets can be mined with existing process discovery algorithms to produce free-choice stochastic Petri nets, and that the structural and behavioral properties of these models reveal whether online behavior is coordinated or organic. In the paper's own terms, the approach is effective in practice in categorizing user behavior online and can be applied to identify, visualize, and simulate coordinated behavior, with structural measures like lower density and larger diameter marking uncoordinated behavior, while faster mean waiting times and higher entropy mark coordinated behavior in the UAE and Honduras datasets.
Load-bearing premise
The load-bearing premise is that taking only the first 10 retweet events of each tweet, and only the first few hundred tweets per country, still yields process models that faithfully preserve the differences between coordinated and organic behavior.
Editorial extensions
If this is right
- If the approach is correct, content-free timing metadata alone can flag coordinated AI-driven misinformation campaigns, bypassing the difficulty of detecting LLM-generated text.
- The discovered stochastic Petri nets are executable, so a matched campaign can be simulated to forecast how quickly and broadly it would spread before it happens.
- Because the reported differences appear even when traces are truncated to their first 10 events, the method points toward early detection of coordination from just the opening moments of a retweet cascade.
- For mixed datasets such as the Brazil election data, the paper suggests that sub-parts of the discovered process models can be inspected individually to isolate bot-like behavior, providing a way to cope with imperfect ground-truth labels.
Reading between the lines
- The paper's own truncation results hint that coordination is visible in the leading edge of a cascade; an explicit testable extension would be to measure how early a reliable coordination signal emerges as a function of the number of initial events.
- The structural separations reported here are discovered post hoc on three datasets; a natural next step would be to use the same features (density, diameter, waiting-time distribution, entropy) as inputs to a classifier trained on labeled traces and validated on unseen countries or platforms.
- Because the method relies only on retweet identifiers and timestamps, it may transfer to other platforms with similar resharing semantics, such as Mastodon or Threads, though the meaning of 'directly-follows' edges would need re-examination for platforms without strict retweet chains.
- The authors note that time distributions in social networks can be heavy-tailed, so the fitted exponential-based delays may understate coordination; replacing them with heavy-tailed fits could sharpen the waiting-time signal.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes to discover free-choice stochastic Petri nets from social-media retweet logs using the Inductive Miner algorithm, then enrich the discovered nets with arc probabilities and delay distributions estimated from the event data. The resulting models are analyzed through structural measures (graph density and diameter) and behavioral measures (mean user waiting times and Kolmogorov-Sinai entropy). The approach is applied to six Twitter datasets from the UAE, Honduras, and Brazil, with coordinated and uncoordinated behavior defined by the original dataset labels or by Botometer scores. Table 1 reports differences between coordinated and uncoordinated models, and K-S tests on per-user mean waiting times are used to support the separation. The Brazil results run opposite to the UAE/Honduras pattern, which the authors attribute to mixed user types.
Significance. If the claimed separation is robust, the paper would introduce a genuinely new process-mining perspective to the study of coordinated online behavior, with formal semantics for concurrency and choice that go beyond existing graph-based and Markov-chain models. The paper also provides reproducible assets: the code and data are linked in Section 4, the formal definitions are clear, and the use of an established discovery algorithm (Inductive Miner) makes the pipeline easy to replicate. However, the central evidence is currently descriptive and rests on a small number of models, each built from truncated and subsampled logs. The significance therefore depends on whether the reported differences survive sensitivity analysis and out-of-sample validation, which the paper does not yet provide.
major comments (1)
- [Section 4, paragraph beginning 'To make Inductive Miner applicable'] The Brazil results are acknowledged to be inconsistent with the UAE and Honduras results: in Brazil, the bot-labeled group has larger waiting times and lower entropy than the non-bot group. The paper explains this by citing the known false-positive/false-negative problem of Botometer and asserts that 'these measures may exhibit inconsistencies'. This is an important caveat, but it also weakens the generality of the claimed behavioral signature. I ask the authors to state clearly which of the three datasets are considered confirmatory and which are exploratory, and to avoid the conclusion that the measures 'consistently characterize bot behavior' without qualifying that this holds only for the two datasets with established ground truth.
minor comments (6)
- [Section 4, Figure 5 caption] The caption contains a typo: 'dateset' should be 'dataset'.
- [Section 4, last paragraph] The text contains 'Barsil 2 dataset'; this should be 'Brazil 2 dataset'.
- [Definition 5] The definition of D as a mapping to 'independent random variables from the set X_D' is underspecified; it would be clearer to define the family of delay distributions (for example, exponential, log-normal, or empirical distributions) and state how the parameters are estimated from data.
- [Section 3.3] The construction of the approximating Markov chain is described only verbally; the paper should state explicitly how the transition probabilities P_{i,j} are estimated from event data and how the 'totally connected' version is formed, since the KS entropy value depends on this construction.
- [Figures 4 and 5] The two Petri-net fragments are not described in enough detail for the reader to identify the claimed 'flower' loop or the sparsity of the uncoordinated model; adding labels for places and transitions or a zoomed view would improve interpretability.
- [Section 4, first paragraph] The sentence 'Consequently, we built two datasets from the the Brazil 2018 election data' contains a duplicated 'the'.
Circularity Check
No significant circularity: the paper fits stochastic Petri nets to externally labeled event logs and reports fitted structural and behavioral summaries; no prediction is claimed from the fitted values, and no load-bearing self-citation or uniqueness argument is used.
full rationale
The paper's derivation chain is: externally labeled Twitter event logs (UAE/Honduras coordination labels from Cima et al.; Brazil bot-score split) are converted to traces; Inductive Miner discovers a free-choice Petri net per group; the nets are then annotated with arc probabilities and delay distributions estimated from the same logs; and structural (density, diameter) and behavioral (mean waiting time, KS entropy) statistics are read off the annotated models. None of these steps is circular. The labels are not defined in terms of the Petri-net measures, and the measures are not presented as out-of-sample predictions: the text explicitly says the nets were 'enhanced with probabilities and time distributions based on the original event log data' and that entropy was 'calculated ... based on state frequencies and transition probabilities.' Comparing descriptive statistics of models fitted separately to externally defined groups is a standard estimation and comparison exercise, not a reduction of the conclusion to the input. The only potentially problematic choices (truncating traces to 10 events, subsampling 200-400 traces, noise threshold 0.2) affect validity and generalizability, not circularity: the resulting metrics are still computed from the data, not from the labels. The self-citations ([25], [26]) are contextual references to prior agent-mining work and are not load-bearing; no uniqueness theorem from the authors is invoked. Consequently, no specific circular step can be quoted, and the appropriate score is 0.
Assumptions & free parameters
free parameters (6)
- Inductive Miner noise threshold =
0.2
- Trace length limit =
10 events
- Number of traces per dataset =
UAE 300, Honduras 400, Brazil 200
- Bot score thresholds =
0.9 and 0.1
- Arc probabilities =
Estimated from event log
- Delay distributions =
Estimated from event log
assumptions (4)
- domain assumption Free-choice Petri nets discovered by Inductive Miner adequately represent the coordination structure in retweet event logs.
- ad hoc to paper Limiting traces to the first 10 events and subsampling the first N traces preserves behavior that differentiates coordinated from uncoordinated users.
- domain assumption A totally connected Markov chain constructed from the reachability graph and transition frequencies approximates the stochastic process well enough to compute Kolmogorov-Sinai entropy.
- domain assumption The ground-truth labels in the UAE and Honduras datasets are reliable, while Brazil labels are treated as potentially unreliable.
Cite this review
Pith. "Pith review of Discovering Coordinated Processes From Social Online Networks." pith.science (2026). https://pith.science/paper/ETSXD7YX
@misc{pith2026250612988,
author = {Pith},
title = {Pith review of: Discovering Coordinated Processes From Social Online Networks},
year = {2026},
howpublished = {\url{https://pith.science/paper/ETSXD7YX}},
note = {Machine review of arXiv:2506.12988}
}
read the original abstract
The rapid growth of social media presents a unique opportunity to study coordinated agent behavior in an unfiltered environment. Online processes often exhibit complex structures that reflect the nature of the user behavior, whether it is authentic and genuine, or part of a coordinated effort by malicious agents to spread misinformation and disinformation. Detection of AI-generated content can be extremely challenging due to the high quality of large language model-generated text. Therefore, approaches that use metadata like post timings are required to effectively detect coordinated AI-driven campaigns. Existing work that models the spread of information online is limited in its ability to represent different control flows that occur within the network in practice. Process mining offers techniques for the discovery of process models with different routing constructs and are yet to be applied to social networks. We propose to leverage process mining methods for the discovery of AI and human agent behavior within social networks. Applying process mining techniques to real-world Twitter (now X) event data, we demonstrate how the structural and behavioral properties of discovered process models can reveal coordinated AI and human behaviors online.
Figures
Figures from the paper (3 more)
Reference graph
Works this paper leans on
-
[1]
van der Aalst, W.M.P., Song, M.: Mining social networks: Uncovering interaction patterns in business processes. In: BPM 2004. pp. 244–260. Springer, Berlin (2004)
work page 2004
-
[2]
Bolzern, P., Colaneri, P., De Nicolao, G.: Opinion influence and evolution in social networks: A Markovian agents model. Automatica100, 219–230 (2019)
work page 2019
-
[3]
Knowledge-Based Systems 134, 149–158 (2017)
Bozorgi, A., Samet, S., Kwisthout, J., Wareham, T.: Community-based influ- ence maximization in social networks under a competitive linear threshold model. Knowledge-Based Systems 134, 149–158 (2017)
work page 2017
-
[4]
IEEE Access12, 61568–61585 (2024)
Cima, L., Mannocci, L., Avvenuti, M., Tesconi, M., Cresci, S.: Coordinated behav- ior in information operations on Twitter. IEEE Access12, 61568–61585 (2024)
work page 2024
-
[5]
Decision Support Systems 160, 113819 (2022)
Cinelli, M., Cresci, S., Quattrociocchi, W., Tesconi, M., Zola, P.: Coordinated inau- thentic behavior and information spreading on Twitter. Decision Support Systems 160, 113819 (2022)
work page 2022
-
[6]
Journal of Computational Social Science7(2), 1139–1160 (2024)
Graham, T., Hames, S., Alpert, E.: The coordination network toolkit: a framework for detecting and analysing coordinated behaviour on social media. Journal of Computational Social Science7(2), 1139–1160 (2024)
work page 2024
-
[7]
In: Proceedings of the AAAI Conference
Hu, B., Sheng, Q., Cao, J., Shi, Y., Li, Y., Wang, D., Qi, P.: Bad actor, good advisor: Exploring the role of large language models in fake news detection. In: Proceedings of the AAAI Conference. vol. 38, pp. 22105–22113 (2024)
work page 2024
-
[8]
Karadoğan, A., Karcı, A.: Marked social networks: A new model of social networks based on dynamic behaviors. Engineering Sci. and Technology35, 100924 (2022)
work page 2022
Show all 32 references
-
[9]
In: 2024 6th International Conference on Process Mining
Kirchdorfer, L., Blümel, R., Kampik, T., Van der Aa, H., Stuckenschmidt, H.: Agentsimulator: An agent-based approach for data-driven business process simula- tion. In: 2024 6th International Conference on Process Mining. pp. 97–104 (2024)
2024
-
[10]
In: ICPM 2024
Klijn, E.L., Tentina, I., Fahland, D., Mannhardt, F.: Decomposing process perfor- mance based on actor behavior. In: ICPM 2024. pp. 129–136 (2024)
2024
-
[11]
IEEE Access (2025) 12 Anna Kalenkova , Lewis Mitchell, Ethan Johnson
Kwon, S., Jang, B.: A comprehensive survey of fake text detection on misinforma- tion and LM-generated texts. IEEE Access (2025) 12 Anna Kalenkova , Lewis Mitchell, Ethan Johnson
2025
-
[12]
In: Application and Theory of Petri NetsandConcurrency.pp.91–110.SpringerInternationalPublishing,Cham(2014)
Leemans, S.J.J., Fahland, D., van der Aalst, W.M.P.: Discovering block-structured process models from incomplete event logs. In: Application and Theory of Petri NetsandConcurrency.pp.91–110.SpringerInternationalPublishing,Cham(2014)
2014
-
[13]
Information Systems124, 102383 (2024)
Leemans, S.J., Maggi, F.M., Montali, M.: Enjoy the silence: Analysis of stochastic Petri nets with silent transitions. Information Systems124, 102383 (2024)
2024
-
[14]
CoRRabs/2404.03021 (2024)
Loth, A., Kappes, M., Pahl, M.: Blessing or curse? A survey on the impact of generative AI on fake news. CoRRabs/2404.03021 (2024)
2024 arXiv
-
[15]
online behavior: A survey
Mannocci,L.,Mazza,M.,Monreale,A.,Tesconi,M.,Cresci,S.:Detectionandchar- acterization of coord. online behavior: A survey. CoRRabs/2408.01257 (2024)
2024 arXiv
-
[16]
Nesterov, R., Bernardinello, L., Lomazova, I.A., Pomello, L.: Discovering architecture-aware and sound process models of multi-agent systems: a compo- sitional approach. Softw. Syst. Model.22(1), 351–375 (2023)
2023
-
[17]
Applied Network Science8 (2023)
Ng, L., Carley, K.: A combined synchronization index for evaluating collective action social media. Applied Network Science8 (2023)
2023
-
[18]
Information Systems Frontiers26(2), 443–458 (2024)
Olan, F., Jayawickrama, U., Arakpogun, E., Suklan, J., Liu, S.: Fake news on social media: the impact on society. Information Systems Frontiers26(2), 443–458 (2024)
2024
-
[19]
In: WWW ’24
Pacheco, D.: Bots, elections, and controversies: Twitter insights from Brazil’s po- larised elections. In: WWW ’24. p. 2651–2659 (2024)
2024
-
[20]
Interna- tional Journal of Information Technology16(3), 1333–1345 (Mar 2024)
Parmar, S., Rahul: Fake news detection via graph-based Markov chains. Interna- tional Journal of Information Technology16(3), 1333–1345 (Mar 2024)
2024
-
[21]
ACM Trans
Polyvyanyy, A., Solti, A., Weidlich, M., Di Ciccio, C., Mendling, J.: Monotone pre- cision and recall measures for comparing executions and specifications of dynamic systems. ACM Trans. Softw. Eng. Methodol.29(3) (2020)
2020
-
[22]
PLOS ONE15(10), e0241045 (2020)
Rauchfleisch, A., Kaiser, J.: The false positive problem of automatic bot detection in social science research. PLOS ONE15(10), e0241045 (2020)
2020
-
[23]
Rizoiu, M.A., Lee, Y., Mishra, S., Xie, L.: Hawkes processes for events in social media, p. 191–218. ACM and Morgan & Claypool (2017)
2017
-
[24]
In: Business Process Man- agement Workshops
Rogge-Solti, A., van der Aalst, W.M.P., Weske, M.: Discovering stochastic Petri nets with arbitrary delay distributions from event logs. In: Business Process Man- agement Workshops. pp. 15–27. Springer International Publishing, Cham (2014)
2014
-
[25]
IEEE Access9, 99480–99494 (2021)
Tour, A., Polyvyanyy, A., Kalenkova, A.: Agent system mining: Vision, benefits, and challenges. IEEE Access9, 99480–99494 (2021)
2021
-
[26]
In: Business Process Man- agement
Tour, A., Polyvyanyy, A., Kalenkova, A., Senderovich, A.: Agent miner: An algo- rithm for discovering agent systems from event data. In: Business Process Man- agement. pp. 284–302. Springer Nature Switzerland, Cham (2023)
2023
-
[27]
In: WWW’18
Wang, P., Angarita, R., Renna, I.: Is this the era of misinformation yet: Combining social bots and fake news to deceive the masses. In: WWW’18. p. 1557–1561 (2018)
2018
-
[28]
In: 2015 IEEE 12th International Con- ference on Networking, Sensing and Control
Wang, Z., Wen, T., Wu, W.: Modeling and simulation of rumor propagation in social networks based on Petri net theory. In: 2015 IEEE 12th International Con- ference on Networking, Sensing and Control. pp. 492–497 (2015)
2015
-
[29]
Social Network Analysis and Mining 11 (2021)
Weber, D., Nasim, M., Mitchell, L., Falzon, L.: Exploring the effect of streamed social media data variations on social network analysis. Social Network Analysis and Mining 11 (2021)
2021
-
[30]
Pew Research Center (2018)
Wojcik, S., Messing, S., Smith, A., Rainie, L., Hitlin, P.: Bots in the Twittersphere: An analysis of the links automated accounts share. Pew Research Center (2018)
2018
-
[31]
arXiv preprint arXiv:2403.03506 (2024)
Zeng, Z., Liu, S., Sha, L., Li, Z., Yang, K., Liu, S., Gašević, D., Chen, G.: Detect- ing AI-generated sentences in human-AI collaborative hybrid texts: Challenges, strategies, and insights. arXiv preprint arXiv:2403.03506 (2024)
2024 arXiv
-
[32]
Microelec- tronics Reliability 31(4), 627–644 (1991)
Zuberek, W.: Timed Petri nets definitions, properties, and applications. Microelec- tronics Reliability 31(4), 627–644 (1991)
1991
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.